How to merge two apps in deployment server

[gnanaraj_mcc]

I am looking for some help in managing apps using the deployment server. Here is the case.
I have two different apps, sending two different logs from the same set of servers. The index and sourcetype are the same. They use the same server class.

App 1:

monitor://G:\Logfiles\subdir1\*.log
monitor://G:\Logfiles\subdir2\*.log

App2

monitor://G:\Logfiles\subdir3\*.log
monitor://G:\Logfiles\subdir4\*.log

Now I have a new requirement to send the all the logs from all the sub directories. There are close to 250 sub directories

monitor://G:\Logfiles\*\*.log

How to do I achieve this?
• Should I disable App1 and App2, create new app to monitor://G:\Logfiles\*\*.log. if yes, how to disable app
• Should I delete App1 and App2, create new app to monitor://G:\Logfiles\*\*.log
• Keep App1 and App2 as it is and create new app to monitor://G:\Logfiles\*\*.log. Will this cause events duplicating
• Keep App1 and App2 as it is and create new app to monitor://G:\Logfiles\*\*.log excluding the subdir1, subdir2, subdir3 and subdir4
Any other ways of doing this?

[somesoni2]

Go with option 2 - remove app1 and app2 from that serverclass and add app3 with new wildcarded input stanza.

[jkat54]

I would create a new app (we will call it app3), merge the inputs from both app1 and app2, then uninstall app1 and app2 via deployment server's UI by removing it from the server classes, and then deploy app3. You can use a tool like notepad++ with the "compare" plugin to compare both inputs.conf and merge between the two.

monitor://G:\Logfiles**.log will not work, should be
monitor://G:\Logfiles...*.log

but even that I would recommend against as it may create a large CPU overhead of the splunkd process.

Would be best to just merge the stanzas from each app into a new inputs.conf.